This fact will allow check of which version of splunk is installed.

splunkupgrade fact

#Splunk Universal Forwarder Version

Facter.add("SplunkUF_Version") do
setcode do
  SplunkUF_Version = Facter::Util::Resolution.exec("/opt/splunkforwarder/bin/splunk --version | awk {'print $4'}")

      if SplunkUF_Version.length < 6
        while SplunkUF_Version.length < 10 do
          SplunkUF_Version.insert(-1, '.0')
        end
      end
          SplunkUF_Version
  end
end